Close Open Privacy Scan

link https://github.com/Kilo-Org/kilocode
bolt Snapshot: commit 00e1646
science engine v1.4
schedule 2026-07-14T01:54:06.972651+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy MCP server detected: @ai-sdk/anthropic, @ai-sdk/openai, @anthropic-ai/sdk, @modelcontextprotocol/sdk +3 more — detected in dependencies, not a safety judgment.

App Privacy Score

100 /100
Low privacy risk

Low risk · 0 finding(s)

Dependency score: 100 (Low risk)

bar_chart Score Breakdown

No category deductions recorded.

list Scan Summary

0 high 0 medium 0 low
First-party packages: 0
Dependency packages: 0

swap_horiz External domains

169.254.170.2abc.comabc123.atlassian.netaccounts.google.comaccounts.spotify.comaccounts.x.aiai-gateway.vercel.shai-sdk.devaiplatformaiplatform.googleapis.comalice.contoso.comapi.anthropic.comapi.apertis.aiapi.cerebras.aiapi.cloudflare.comapi.cohere.comapi.deepinfra.comapi.deepseek.comapi.descope.comapi.digitalocean.comapi.fireworks.aiapi.github.comapi.githubcopilot.comapi.groq.comapi.inceptionlabs.aiapi.kilo.aiapi.llmgateway.ioapi.login.yahoo.comapi.mijnprovider.comapi.mio-provider.comapi.mistral.aiapi.miy-provyder.comapi.morphllm.comapi.myprovider.comapi.openai.comapi.perplexity.aiapi.releases.hashicorp.comapi.saglayicim.comapi.together.xyzapi.v0.devapi.venice.aiapi.voyageai.comapi.x.aiapi.x.comapp.kilo.aiapp.posthog.comappleid.apple.comauth.openai.comauth.x.aiautolink.comavatars.githubusercontent.combedrockbedrock-agent-runtimebedrock-agent-runtime.us-west-2.amazonaws.combedrock-mantlebedrock-mantle.us-east-1.api.awsbedrock-runtimebedrock-runtime-fipsbedrock-runtime.us-east-1.amazonaws.combit.lybitcoin.orgblog.kilo.aicdn.pixabay.comcdn.tailwindcss.comcdnjs.cloudflare.comchat.kiloapps.iochatgpt.comcli.github.comcloud.digitalocean.comcloud.gitlab.comcloudflare.comcodeload.github.comcodestral.mistral.aicommunity.chocolatey.orgcompany.ghe.comconsole.opencode.aicontacts.contoso.comcopilot-apicorvu.devdashboard.contoso.comdashscope-intl.aliyuncs.comdev.kilo.aideveloper.mozilla.orgdevelopers.cloudflare.comdevelopers.google.comdiscord.comdocs.anthropic.comdocs.cloud.google.comdocs.expo.devdocs.github.comdocs.oasis-open.orgdownload-cdn.jetbrains.comdynamodbemscripten.orgfonts.googleapis.comformulae.brew.shgateway.ai.cloudflare.comgenerativelanguage.googleapis.comgit-scm.comgithub.comgitlab.comglobalgoo.glgoogle.aip.devgoogle.comgraph.facebook.comgraph.microsoft.comhelp.openai.comiconscout.comid.twitch.tvinference.baseten.coinference.do-ai.runingest.kilosessions.aiintegrate.api.nvidia.comjigsaw.w3.orgjson-schema.orgjulialang.orgkilo.aikilo.internalkilocode.aikobalte.devlogin.microsoftonline.commacvmlschemaurimanagement.stytch.commcp.exa.aimermaid-js.github.iomermaid.js.orgmermaidjs.github.iomodelcontextprotocol.iomodels.devmorphllm.commotion.devmy-bucket.s3.amazonaws.commy-malicious-site.examplemy-models.openai.azure.comnpm.imoauth.id.jumpcloud.comoauth2.googleapis.comoncall.contoso.comopenauth.js.orgopencode.aiopenoffice.orgopenrouter.aiopncd.aiorm.drizzle.teamplacehold.coplatform.claude.complatform.openai.complaywright.devpmzuybqdak-dsn.algolia.netposthog.compurl.oclc.orgpurl.orgraw.githubusercontent.comreact.devreactjs.orgreddit.comregistry.mycorp.comregistry.npmjs.orgrepo.contoso.comrepos.morphllm.coms3s3-fipss3-fips.dualstacks3-fips.dualstack.us-east-1s3-fips.us-east-1s3-object-lambdas3-object-lambda-fipss3.amazonaws.coms3.dualstacks3.dualstack.us-east-1s3express-controls3express-control-fipss3express-control-fips.dualstacks3express-control.dualstackschemas.microsoft.comschemas.openxmlformats.orgschemas.zwobble.orgsearch.parallel.aisentry.iosheetjs.openxmlformats.orgslack.comsolidjs.comspec.commonmark.orgsst.devstorybook.js.orgstripe.comstuk.github.iostytch.comsupabase.comsupermassive-black-hole.kiloapps.ioswagger.contoso.comtermux.comtest.openrouter.aitests.contoso.comtwitter.comunpkg.comus-assets.i.posthog.comus.i.posthog.comus.posthog.comvercel.comvercel.linkvia.placeholder.comwebplatform.github.iowiki.contoso.comwww.anaconda.comwww.contoso.comwww.eclipse.orgwww.facebook.comwww.googleapis.comwww.morphllm.comwww.npmjs.comwww.sitemaps.orgwww.terminal.shopwww.typescriptlang.orgwww.w3.orgwww.youtube.comyour-instance.kiloclaw.aiyoutuzenmux.ai로

Skipped dependencies

Production

  • @opencode-ai/script prod — registry 404
  • @kilocode/plugin prod — dist-only: no readable source
  • @kilocode/sdk prod — dist-only: no readable source
  • @gitlab/opencode-gitlab-auth prod — dist-only: no readable source
  • @kilocode/kilo-gateway prod — registry 404
  • @kilocode/kilo-indexing prod — registry 404
  • @kilocode/kilo-memory prod — registry 404
  • @kilocode/kilo-telemetry prod — registry 404
  • @kilocode/plugin-atomic-chat prod — registry 404
  • @kilocode/sandbox prod — registry 404
  • @opencode-ai/llm prod — registry 404
  • @solid-primitives/event-bus prod — dist-only: no readable source
  • cli-sound prod — dist-only: no readable source
  • opencode-gitlab-auth prod — dist-only: no readable source
  • opencode-poe-auth prod — dist-only: no readable source
  • tree-sitter-wasms prod — no javascript source
  • partial-json prod — dist-only: no readable source
  • @kilocode/kilo-ui prod — registry 404
  • @opencode-ai/effect-drizzle-sqlite prod — registry 404
  • @opencode-ai/effect-sqlite-node prod — registry 404
  • @solid-primitives/event-listener prod — dist-only: no readable source
  • @solid-primitives/media prod — dist-only: no readable source
  • @solid-primitives/resize-observer prod — dist-only: no readable source
  • @solidjs/router prod — dist-only: no readable source
  • motion prod — dist-only: no readable source
  • @solid-primitives/bounds prod — dist-only: no readable source
  • @docsearch/css prod — no javascript source
  • @xyflow/react prod — dist-only: no readable source
  • next prod — tarball exceeds byte cap
  • @lancedb/lancedb prod — dist-only: no readable source
  • @qdrant/js-client-rest prod — dist-only: no readable source
  • hono prod — dist-only: no readable source
  • hono-openapi prod — dist-only: no readable source
  • aws4fetch prod — dist-only: no readable source
  • @kilocode/kilo-i18n prod — registry 404
  • @thisbeyond/solid-dnd prod — dist-only: no readable source
  • lru-cache prod — dist-only: no readable source
  • uri-js prod — dist-only: no readable source
  • @kilocode/kilo-web-ui prod — registry 404
  • @lottiefiles/dotlottie-web prod — dist-only: no readable source
  • ghostty-web prod — dist-only: no readable source
  • @solid-primitives/rootless prod — dist-only: no readable source
  • @solid-primitives/lifecycle prod — dist-only: no readable source
  • lucide-solid prod — dist-only: no readable source